Webapp Enum Methodology
Take note of EVERYTHING, when in doubt, write it down.
Enumerate Services running with nmap
View page source, look for versions, comments,hyperlinks
Add the target to /etc/hosts (particularly for wordpress)
Remember to try BOTH http and https
Inspect element and check response headers
use dirb/gobuster/ferox/ffuf , try different wordlists
Speaking of wordlists, use custom and service specific (.cgi)
Look for subdomains with wfuzz (refer to "tools" node)
Use whappalyzer and whatweb to discover services running
Check certificates and see if there's anything juicy
Check robots.txt and any disallowed entries
Check for default creds for a specific service running
Bruteforce login pages as a last resort, try common combos
Check for SQLi and XXS
See if a path traversal is possible, then --> RCE/LFI
If RCE gets hard, try php filters
Check if you can steal or manipulate cookies in any way
Cookie flag IsAdmin=false , change it to IsAdmin=true
Intercept requests with burp and look for versions, software..
Searchsploit should be the last step, enumerate first!
Last updated